shaders-cursor-ripples

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the shaders package from the public NPM registry. This package is necessary for the skill's primary function of rendering WebGPU effects.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes image URLs provided at runtime to apply the shader effect. This represents a potential indirect prompt injection surface.
  • Ingestion points: The imageUrl property in assets/react/cursor-ripple-shader.tsx and the url property in the ImageTexture component in SKILL.md.
  • Boundary markers: None present; the URL is interpolated directly into the component props.
  • Capability inventory: The skill's capabilities are restricted to visual rendering through the shaders library components (Shader, ImageTexture, CursorRipples). No file system access, network exfiltration, or shell execution capabilities are present in the provided scripts.
  • Sanitization: The skill does not perform explicit validation or sanitization of the imageUrl string.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 01:30 AM
Security Audit — agent-trust-hub — shaders-cursor-ripples